Judge the SDK conformance fixtures against the SDK the controller pins, never a desktop's checkout (issue 449)

A check clones mesh-sdk beside the controller at the commit go.mod pins; elsewhere
the test reads a copy captured at that commit, held to go.mod. A missing clone fails
instead of skipping.

testdata/beside/CAPTURED

@@ -9,6 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
 mesh-host     bd5cc6980419c1bd4824be6d58dfebd2381a9de3  examples/foundation-first-node-nats.lock
+mesh-sdk      f047d0a4a9702f5d7f3d7eadd3e62496311acc00  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 
@@ -19,4 +20,8 @@ To move them, from this repository's root, with the two repositories checked out
   find testdata/beside -name module.json -exec mv {} {}.captured \;
   git -C ../mesh-host archive <commit> examples/foundation-first-node-nats.lock | tar -x -C testdata/beside/mesh-host
 
-and write the commits here.
+and write the commits here. The SDK is captured at the commit go.mod pins for git.novox.be/novox/mesh-sdk/go
+(the last part of its pseudo-version; novox/hq issue 449), which internal/link's conformance test holds it to:
+
+  rm -rf testdata/beside/mesh-sdk && mkdir -p testdata/beside/mesh-sdk
+  git -C ../mesh-sdk archive <commit> conformance/events | tar -x -C testdata/beside/mesh-sdk